---
title: "List the company audit journal"
method: GET
path: "/company/audit-log"
tags: ["Company"]
---

# List the company audit journal

`GET /company/audit-log`

## Request

- Base URL: `https://api.atako.ai`
- URL: `https://api.atako.ai/company/audit-log`
- Auth: HTTP bearer

Company-admin only. Cursor-paginated, most recent first by default.

## Query parameters

- `cursor` string
- `limit` integer
- `sort` 'asc' | 'desc'
- `actorId` string, uuid
- `actorAgentId` string, uuid
- `action` string
- `status` 'ok' | 'denied' | 'error'
- `entityType` string
- `entityId` string, uuid
- `from` string, date-time
- `to` string, date-time
- `q` string
- `qActions` string

## Response `200`

- AuditLogPage
  - `logs` AuditLogEntry[], required
    - `id` string, uuid, required
    - `createdAt` string, date-time, required
    - `action` string, required
    - `status` 'ok' | 'denied' | 'error', required
    - `entityType` string, nullable
    - `entityId` string, nullable
    - `ip` string, nullable
    - `meta` object, nullable
    - `actor` union, required: Who performed the action — a member, an agent acting on the company's behalf, or the system itself.
      - object
        - `kind` 'user', required
        - `id` string, uuid, required
        - `name` string, nullable
        - `email` string, nullable
      - object
        - `kind` 'agent', required
        - `id` string, uuid, required
        - `name` string, nullable
      - object
        - `kind` 'system', required
        - `id` unknown
        - `name` unknown
    - `target` object, nullable: Who/what the action was about, when that differs from the actor (e.g. a member removed by an admin).
      - `userId` string, uuid, required
      - `userName` string, nullable
      - `userEmail` string, nullable
  - `nextCursor` string, nullable, required: Opaque cursor — pass back as `?cursor=` to fetch the next page, null once exhausted.

## Other responses

- `400`: Validation error, or an invalid cursor.
- `401`: Missing, malformed, or invalid bearer token / API key, or revoked session (SESSION_REVOKED).
- `403`: The caller does not have the required role/permission.
- `404`: No company found

---

[API](https://skmtc.dev/atako/apis/atako-api.md) · [All operations](https://skmtc.dev/atako/apis/atako-api/llms.txt) · [OpenAPI document](https://skmtc.dev/atako/apis/atako-api/revisions/aa555c56fbd7?raw)